I have the following simplified version of the query where for each caller, I need all_calls (from sourcetype=x) and messagebank_calls (from sourcetype=y).  index=sample1 sourcetype=x host=host1 | stats values(caller) as caller by callid | stats count as all_calls by caller | rename caller as caller_party | appendcols [ search index=sample1 AND sourcetype=y | stats count as messagebank_calls by caller_party] | search all_calls=*   messagebank_calls value is incorrect and I'm guessing because of the subsearch/appendcols? How do I increase the limit or re-write so I can get the same results caller, all_calls, messagebank_calls? ... View more

For simplicity assume I have the following saved as a report (testReport): index=testindex host=testhost earliest=-90m latest=now I need to create 2 bar graphs in the same chart comparing two dates.  For starters I need to be able to run the above with a time I specify overrriding the time range above. | savedsearch "testReport" earliest="12/08/2024:00:00:00" latest="12/08/2024:23:59:00" I have seen a few similar question here but I don't think it has  a working solution.      ... View more